Fossroot v0.1.0

Fossroot v0.1.0 — first release. Open-source, single-binary manager for DoD PKI CA certificate trust stores; a modern, auditable alternative to DISA's InstallRoot.

⚠️ Unofficial community tool. Not affiliated with or endorsed by the U.S. Department of War, DISA, or any government agency.

What's in this release

• fossroot-v0.1.0-x86_64-windows.exe — Windows x64, single self-contained executable. No installer, no runtime dependencies, no config files. Double-click for the GUI; run with arguments for the CLI (status, install, remove, export).

How it works

Fossroot ships zero certificates. It fetches the latest DoD PKCS#7 bundle live from DISA's official distribution point, verifies DISA's CMS-signed checksum manifest back to DoD Root CA 3/4/5/6 fingerprints pinned in the source, and signature-verifies every certificate chain (RSA + ECDSA) to a pinned root before anything is written. It fails closed. Use --offline <bundle.zip> for air-gapped machines.

Verified against DoD PKI bundle v5.14.

⚠️ This binary is not code-signed

Windows SmartScreen will show an "unknown publisher" warning on download/run. Verify the download before trusting it:

Get-FileHash .\fossroot-v0.1.0-x86_64-windows.exe -Algorithm SHA256

Expected SHA-256:

9f0d8b3335d99fbfa0d9316698fbb9cf186c92804fd33453ebcb1733f4c94272

This must match fossroot-v0.1.0-x86_64-windows.exe.sha256. If you'd rather not trust a prebuilt binary, build it yourself with cargo build --release — the full source is in this repo.

Known limitations

• Windows only in this release. macOS and Linux trust-store backends are on the roadmap (the core is already platform-agnostic).
• Covers the DoD bundle. ECA / JITC / WCF groups and Firefox NSS support are planned.

License

Dual-licensed MIT OR Apache-2.0.

Full Changelog: https://github.com/danielneustadter/fossroot/commits/v0.1.0